ember
Documentation menu

Reference

Registry & endpoints

Last updated October 23, 2026

The website#

emberpm.dev — search the catalog, package pages with readmes, browsable source, and version history, and the policies. Security contact: admin@emberpm.dev.

Universal search also searches the other registries Ember installs from: Wally, pesde, and Forest. For Forest it lists only the packages published to Forest, not its copies of Wally packages, and it reads a copy of Forest's catalog that the site takes at each deploy.

  • Filters. The search page filters by environment and by language. Each row takes several chips at once: a package shows when it fits any chip that is on in a row, and it must fit both rows. Click a chip again to turn it off. All clears its row.
  • Trending. With no search or filter on, a small row above the results shows the packages with the most downloads this week.
  • Other registries. A Wally, pesde, or Forest package has its own page here. A Forest page shows Forest's download count, labelled "Downloads on Forest". Wally and pesde count no downloads, so their pages show none.
  • Reports. The Report button on a package page sends a report to the moderators, for a package that breaks the policies, such as malware or an inappropriate logo.
  • Playground. A package that runs outside Roblox has a link to try it in the playground.

The homepage crowns one package as featured: the most downloaded package in the registry, computed from the download counts in the public search-index.json, with ties going to the newer publish. Counts accumulate nightly, so the crown can move as downloads land. Featuring is fully automatic; it cannot be bought, sponsored, or hand-picked.

The CDN (public, unmetered)#

  • https://cdn.luaupm.com/{scope}/{name}/{version}.tar.gz — immutable package tarballs. A version can ship for several targets. The first target takes this key, and a later target takes {scope}/{name}/{version}/{target}.tar.gz. Each index entry's download URL names the right one.
  • https://cdn.luaupm.com/search-index.json — the whole catalog, latest version per package.
  • https://cdn.luaupm.com/stats.json — package, publisher, and download counts.
  • https://cdnpreview.luaupm.com/{scope}/{name}/{version}.tar.gz — byte-identical tarball copies on a separate host, used by the website's source viewer. Fetches here never count as downloads, so browsing a package's files does not inflate its numbers.

No token, no metering: CI can install at any scale for free.

The API#

https://api.luaupm.com:

  • POST /v1/publish — used by the CLI only.
  • GET /v1/packages/{scope}/{name} — full version history for a package.
  • PUT and DELETE on /v1/packages/{scope}/{name}/{version}/yank, and on /v1/packages/{scope}/{name}/deprecate or .../{version}/deprecate — used by embr yank and embr deprecate. Scope owners only.
  • POST /v1/packages/{scope}/{name}/report — the website's Report button. No login; rate limited.

Installs never require the API — resolution reads the public index repo (github.com/ember-luau/index) over git, and entry files bake in their CDN download URLs. If the API is down, embr install keeps working.

Badges#

Every package page offers copy-paste shields.io badges (version and downloads) for readmes — open a package and expand Badges in the sidebar.